Proxy Shell Execution via Busybox

process where host.os.type == "linux" and  event.type == "start" and event.action == "exec" and process.parent.name == "busybox" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.command_line in ("bash", "bash-", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
not (
  process.args == "-c" or
  process.parent.args : (
    "crond", "/usr/sbin/crond", "/local-registrator.sh", "/var/atlassian/application-data/bamboo-agent*"
  ) or
  process.parent.command_line in (
    "sh /readonly-config/fix-split-brain.sh",
    "/bin/sh -c /health-check.sh
| 
| bash -c 'kill -s 15 $(pidof siridb-server) && (sleep 10; kill -s 9 $(pidof siridb-server))'"
  ) or
  process.command_line == "bash /etc/kafka/docker/run" or
  process.parent.command_line like (
    "/bin/sh -c apk add*", "/bin/sh -c crm-cron-enabled*", "udhcpc -n -p /run/udhcpc.*", "flock -x*"
  ) or
  process.working_directory == "/usr/share/grafana"
)